run-shell-injection.yaml

rules:
- id: run-shell-injection
  languages:
  - yaml
  message: 'Using variable interpolation `${{...}}` with `github` context data in a `run:` step could
    allow an attacker to inject their own code into the runner. This would allow them to steal secrets
    and code. `github` context data can have arbitrary user input and should be treated as untrusted.
    Instead, use an intermediate environment variable with `env:` to store the data and use the environment
    variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".'
  metadata:
    category: security
    cwe:
    - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    references:
    - https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
    - https://securitylab.github.com/research/github-actions-untrusted-input/
    technology:
    - github-actions
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
  patterns:
  - pattern-inside: 'steps: [...]'
  - pattern-inside: |
      - run: ...
        ...
  - pattern: 'run: $SHELL'
  - metavariable-pattern:
      language: generic
      metavariable: $SHELL
      patterns:
      - pattern-either:
        - pattern: ${{ github.event.issue.title }}
        - pattern: ${{ github.event.issue.body }}
        - pattern: ${{ github.event.pull_request.title }}
        - pattern: ${{ github.event.pull_request.body }}
        - pattern: ${{ github.event.comment.body }}
        - pattern: ${{ github.event.review.body }}
        - pattern: ${{ github.event.review_comment.body }}
        - pattern: ${{ github.event.pages. ... .page_name}}
        - pattern: ${{ github.event.head_commit.message }}
        - pattern: ${{ github.event.head_commit.author.email }}
        - pattern: ${{ github.event.head_commit.author.name }}
        - pattern: ${{ github.event.commits ... .author.email }}
        - pattern: ${{ github.event.commits ... .author.name }}
        - pattern: ${{ github.event.pull_request.head.ref }}
        - pattern: ${{ github.event.pull_request.head.label }}
        - pattern: ${{ github.event.pull_request.head.repo.default_branch }}
        - pattern: ${{ github.head_ref }}
        - pattern: ${{ github.event.inputs ... }}
  severity: ERROR